/var/lib/krb5kdc/ is in krb5-kdc 1.12.1+dfsg-19+deb8u4.
This file is owned by root:root, with mode 0o700.